Cosmos Hub Recovers 1.227 Million ATOM, Funds Stored in 4/6 Multisig Address

On September 22, Neutron suffered a governance attack, resulting in approximately 1.73 million ATOM being stolen and transferred to Cosmos Hub. Cosmos Hub was not attacked, and user funds were unaffected. To prevent the stolen ATOM from being further transferred, Hub validators paused the network for about 24.5 hours and resumed block production on September 23 based on the patched Gaia v28.3.0. During the pause, 1.227 million ATOM remained in the attacker's Hub address, and when the network was restored, it was transferred to a 4/6 multisig address composed of Nansen, Keplr, Enigma, Silknodes, Kiln, and Polkachu. Previously, about 500,000 ATOM had been exchanged for ETH via THORChain and could not be recovered; another 169,000 ATOM entered the attacker's address after the network was restored due to THORChain refunds and were sold after being transferred to Osmosis. Currently, the multisig address holds approximately 1.227 million ATOM, which can only be returned after authorization from Cosmos Hub governance proposals, and the related funds will not be staked, lent, or traded. The Neutron team expects to submit a recovery plan and related governance proposals next week.